For data frames, two sock_put() calls were added to plug a refcnt leakper received data frame. The ref that is grabbed at the top ofpppol2tp_recv_core() must always be released, but this wasn't done foraccepted data frames or data frames discarded because of bad UDPchecksums. This leak meant that any UDP socket that had passed L2TPdata traffic (i.e. L2TP data frames, not just L2TP control frames)using pppol2tp would not be released by the kernel.